Kubernetes WG Multi Tenancy, 2 Jun 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: 20200602 Kubernetes Working Group for Multi-tenancy

Description

- Multi-Tenancy Benchmarks (MTB) update and demo [Anuj, Jim] (~15 mins)
- HNC v0.4.0 RC1 is released: https://github.com/kubernetes-sigs/multi-tenancy/releases/tag/hnc-v0.4.0-rc1. Thanks to @Ryan Bez as always for his reviews, and to @yiqigao217 for her contributions! Yiqi will review the changes to HNC at the next wg-multitenancy meeting.

A

Hi everybody and welcome to the regular working groups of multi-tenancy meeting today.

B

A

Going to go over the multi-tenancy benchmark project with an update and a demo from that team, and then equi is going to go over the latest update to the hierarchical namespace controller, so handing it over to Jim for multi-tenancy benchmarks, Thank.

C

You Tasha I am seeing a message saying that the host disabled participant screen sharing, so you may need to do some magic to enable that or I could send you the link to the slides.

A

I'm just messing with permissions: I guess this is what happens when we make things more secure here, you're a co-host. Thank.

C

You Oh works now perfect, all right. Let me pull up the slide deck and then I'm gonna hand off to a Nuge to do a quick demo as well. So you might need to make him co-host as well. Okay, so just a quick update, you know on the multi-tenancy track so for those of you are familiar with some of the different initiatives in our working group. The multi-tenancy benchmarks is one of the three projects that we're currently pursuing, so the other one we'll hear from today is the HNC project.

C

There's also the virtual cluster project that fey has been leading. So the goal of the benchmarks project is to establish a set of guidelines and standards on how to configure multi-tenancy within clusters, and the focus here is to stay implementation, agnostic, s-- and not take any particular stance on what the implementation is, but focus more on, measuring whether multi-tenancy has been achieved, and it's part of that.

C

What we've done is defined three different profile levels out seven categories and about twenty or so- and this list is growing automated test that we want to perform to measure multi-tenancy, and all of this is on the git repo I. Have a link in these slides and I have also linked the slides to the agenda document. So you can reference it from there.

C

So one thing which I'm very happy to announce with help from Tasha and everybody in the group we have some new folks joining us who will be participating and there are two students participating through different programs over the course of the summer they're, both here so I'd love for them to introduce themselves quickly to the team. So maybe starting with your Nugent and Divya, if you could introduce yourselves, can I listen me. Yes, we can year ago.

D

Okay I'm the final year graduate from the NAD good, Chaitra and I am being contributing to the kubernetes till last year, so I tried for the DS of last year, but unfortunately, I didn't get selected. So this time, thanks to the thanks to the gyms and the other mentors I got selected. So my mainly my I am interested in cloud negative things, so yeah I'm very hype about the contributing in the multi-tenancy benchmarks.

C

Divya are you on as well.

E

E

I am working as a committee Antonio and previously participated in G, sock and outreach year.

C

Thank you. Yes, sir, welcome to beyond anujan great great to have you for the summer and will you know B we'll talk a little bit about what we'll be working on so before we go into more details, just a quick, you know recap on where we were with this project and what we're previously done. So we had automated some of the level 1 tests defined in the repo.

C

The way we have done, this automation is using the e e test framework and underneath the covers that uses coop, coral ginko for behavioral tests and some of the challenges we saw with. That was you know and how we would organize and grow the test code, how we could also in test the test its themselves. So we wanted to make sure the unit tests were tested, and this you know, was something we're trying to figure out and then the other.

C

The main problem we started seeing is the user experience this led to you, which was you know it's fairly fairly usable in terms of the output etc, but it didn't provide all the controls that we were looking for from. You know from a tool to measure multi-tenancy, so the new approach we started prototyping just a few weeks ago, with some inputs from for others as well as we started looking at just using client code directly instead of the to a test framework.

C

We also you know researched how this the multi-tenancy benchmarks test could be, could work as a coop cuddle plug-in, and we wanted to you know to do this. We would create a small set of types basically to organize tests and keep you know, keep this modular and flexible and what we were looking for. The benefits we're looking for is, of course, controlling the user experience and you'll see that in a quick demo of Korah and the drawback on the flip side is there's a little bit more coding involved and more stuff to maintain.

C

But overall we're feeling this is well worth. It then would love to get feedback and thoughts on what a neutral demo. So what we're gonna go through and I'm gonna hand off to your new Jeff to this is we're gonna, run multi-tenancy benchmarks on a new cluster and namespace, and what we'll do is we'll also run this with the tenon controller. So this is the tenancy Rd which is part of the overall. You know what row cluster project, but also can be used ten alone and then we'll also run.

C

You know multi-tenancy benchmarks with pod security policies in able to show what the outputs look like there. So those are the three main components of the demo and then we'll you know we can sort of get I, guess answering questions or I think about next steps, all right. So let me stop sharing and I knew if you want to share okay, just riddim.

D

Okay, can you see my screen? Yes, we can thank you. Okay, so from here, I just created a kind class trying kubernetes cluster with the configuration that enables the pod security policies in the kind cluster, so I just recorded a whole demos, so there will be no shade chance of failure.

D

First, I applied the privileged port security policy, so deadlock ports can be created, otherwise it they will get blogged. So here we can see the port security after the privilege policy skipping. This part.

D

So I wrote a script to install the tenant controller and, with the help of the tenant controller, I created the tenants and the tenant namespaces actually I. Let me show you off. Let me show you the script and where I get this thing from automation from.

D

Can you see my via score screen yep, so here are the links that are shared in the multi-tenancy repo I, just automated whole steps given, in the rate rid me of the tenant controller. If we move to the.

D

Yeah from here, I am just automating all the all these commands in my script and so I just loop around this script. This command for two times to create two tenants back to the demo.

D

We'll see ya here we are creating the two tenants.

D

Okay, so if we get get the tenants, it will show the two tenants at a net, zero c CR and tenant 1 CR and for the corresponding tenants Elvia. We have two tenant ed namespace 10 into 0 admin and the tenant. One admin.

D

So this is this: was the PSP are used to generate to the ports in the cube system?

D

We will apply it so now what we will do. We will make one tenant of valid valid to clear the all the benchmarks and one to see the failure. So I created I created two PS PS, in which I specified according to the benchmark. What to be wrong on what to be false. I can show you the PSP later.

D

So here this is what this was the PSP like in which, in this I just put the privilege false and this this is a valid tenant, PSP like privilege to the falls and other all things that can breach the security to the false and I, apply it to the tenon 0 CR.

D

And this is that invalid tenant, PSP, ok in which I said the privilege to if you can see where it is.

F

D

D

Okay, let's I applied both the PSP and the roles to the corresponding tenants, tenant. Namespace. Sorry.

D

So if we see the poor security policies, we now have total three four security policies. One is privileged and the two, the two other policies that restrict it, restricts the code say capacity, so we will now now delete the PSP privileged because it according it will.

D

So here here is the our command line tool cube, cube control, MTB. It has now two comets listing the tests, the listed list, all the benchmarks. At present, we have now three all of all of the profile level one and that test just run the test with the appropriate flex.

D

It takes two flex, one is a tenant namespace and the another is a tenant admin service account name. At present we are just assuming that it would be the tenant service account name. We will check further change data to user or any other use user input.

D

Okay, so if we run the benchmark to the valid tenant, it will pass all the benchmarks. Okay, you can see it's passed all the benchmarks and it will show you the output like this. Now we can use this output to show the user to to check their report in either dashboard or in any other ml file or any other UI like HTML page, or something like that. If your now, if we run the benchmarks on invalid, it will fail the test.

D

Yeah, so it cleared one test. Oh, that is very my new test, so it cleared that, but it felt other tests now you can see the error, but what was the error, and it also shows the remediation to correct this, to make this a tenant, a valid tenant of what we can do to make to this day. That's all any questions.

C

Yes, just to you know kind of add a few points to that. Thank you great great demo and I think what we wanted to do. There was just show quickly the user experience. Of course this only contains a few tests, but we think this would be a much easier way for folks to try out and use the tool. So we can distribute this as a cuddle plug-in they can download it, and really all you need is a namespace. You want to run this on for the profile level.

C

One test, the level two level three get a little bit trickier because those require creation of new namespaces as well for some of the tests, so we're still trying to figure out the best way to do that so so far, you know and we're definitely looking for more inputs comments to see what we can do better year. If there's other improvements, we can, you know explore for the user experience. But, let's let us know- and you know a few of us have been meeting weekly in addition to, of course, these working group meetings.

C

So if you want to join those meetings, please reach out and let me know or if you have any other thoughts or career feedback on this one.

G

One question, though, this test charge is your plans of being able to provide a custom test to this, or did you show how to create one of these tests? Oh no I didn't do that. No.

C

It's a year, URI, you know, I haven't shown the details of the test case itself, but these would be written in go code. The plan is to collect a set of benchmarks that we would want to run, so these would not be user customizable, but, based on on our git repo, we have a set of checks which describe what each one of those checks do you so much like. You know it, of course, with CIS benchmarks for kubernetes. They have about a few like a hundred and twenty or so checks across different categories.

C

That's how we modeled these checks, as well across different categories and to test different of multi-tenancy within a cluster.

C

Did that answer you.

G

Know I get it I'm just wondering.

G

So if we, if one needed to add something to a benchmarking, because let's say our networking requirements for multi-tenancy might be a lot more sophisticated than others right, we do things that I would say: 99% of the population will never need to do, and but we wanted to validate an environment, and- and you wanted to have something like this as a tool to do that validation are supposed to need to do this plus something else.

G

So is there a sod off? I guess is the idea. You're gonna have a collection of tests of a generic and then some add-ons, perhaps exactly right.

C

So we will and let me quickly share what we have on the get repo.

C

So this is just on the kubernetes Ickx multi-tenancy. If you go there into the benchmarks folder, so this is where we have all the generic tests defined that we are addressing. So definitely, if there's any thoughts inputs, if there's different levels feel free to you know, look at those in comment or even submit a PR for other. You know definitions, but this is the starting set that we were looking at initially to automate tests, for it is an interesting idea if there's a way to sort of customize this without having to write code.

C

You know, if you have some ideas on that yeah I would love to explore more well.

G

Even even if we have to write, go module, that's okay as long as it's something that is easy to plug into this right, as opposed to having to go through a whole process of a review whose upstream, but this community. If, if we're doing something, that's so custom, you guys will never be able to approve it, because it's not generic enough right sure got some things.

B

G

Here, like things like I, don't know in our case for multi-tenancy, there seems like the image boat policy should always be. You know all the lanes.

A

G

It seems like correctly right, yeah.

C

So there are, there are a few other comments which you know we will be updating these this, the level 1 tests with and level 2 will sort of go into more details, for you know in terms of being able to even allow self-service and creation of namespaces and then level 3. So this is something we will test with like agency, as well as with other projects like OPA, gatekeeper in Kiev or no and then level 3 is very, very you know, planning on testing with virtual clusters, project.

C

So you have feel free to browse the repos and you know add comments and we will be starting to you know once one now that we have the basis of the tool and define some of the initial infrastructure. Will you will, you know, be making progress to so.

G

One question, though, you're you're not basing this on the isn't. The the tenant, namespace controller, I, hope or is that completely in is your expectation? Is that a tenant has namespaces, but how I build those neat spaces I, don't care right.

C

That's exactly right, so we're not imposing any one particular way of building namespaces, but you know and we're assuming there will be multiple ways. For example, like you know, tools like cube flow have their own sort of multi-tenancy built in right. So.

F

C

Want to allow for that as well. Okay,.

G

Here's some kubernetes native artifacts can configure in certain way you don't care sounds good. Thank you sure.

C

You're welcome all right so just to keep on time. Tasha I think we will stop here. But if there's any other comments, questions please child on slack channel also.

A

Thank you so much cool okay. So Equis are you ready to go for hierarchical, namespace, controller.

F

Yes, yes, sure, can you hear me? Yes, okay, my name is hi everyone. My name is Ichigo I work with Adrian on agency and I'll, give an update on agency v 0.4. So in this version we added we renamed the stuff service namespace to sub namespace and also the custom resource from hierarchical namespace to sub name.

F

Some names based anchor, and the reason is that all names basis in agency are actually hierarchical already and also this resource is added to a parent namespace for agency to create sub namespaces, so sub names based anchor makes more sense, and we in this version also, we no longer require users to install search manager as a prerequisite to installation C.

F

We also added names based conditions to matrix, so users can see how many names we are having conditions and also whether the conditions are critical. We also did some effects on handling conditions. For example, we will still update tree labels, even when the namespace has critical conditions and for namespace cycles, so the psychos means the cycle in the namespace hierarchy.

F

Previously, we only add invalid parent condition on one random namespace in the cycle, and now we have cycle condition to be placed on all namespaces in the cycle and also the condition will have the information of all the namespaces.

F

That's in the circle, that's in the cycle. That's pretty much it um does. Anyone have any questions.

A

Cool well, thank you very much for going over that with us, yeah sure, and so everyone on the call knows the code for both of these projects is that blowing github under the multi-tenancy working group under kubernetes cigs and the links are posted in all of our docs. So if you join our mailing lists, you'll get a link to our Docs and then you can easily find the github page from there.

A

If you don't already have the link and obviously we're all in the kubernetes slack and we're all happy to answer questions about these projects there as well cool. Well, thank you very much for those great presentations and chat with everybody. Later.